This vulnerability in OTTO® Fleet Manager arises from employing bcrypt password hashing with a work factor that is too low, thereby decreasing the computational cost for attackers to perform offline brute-force attacks against stored password hashes. If an attacker gains access to an unencrypted system backup containing these hashes, they could more feasibly recover user passwords. The CVSS 4.0 base score is 6.9 (medium severity), reflecting the attack vector as adjacent network with low attack complexity and no user interaction required. There is no known exploit in the wild and no vendor-provided patch or remediation level at this time.

An attacker with access to an unencrypted system backup containing password hashes could perform offline brute-force attacks more efficiently due to the insufficient bcrypt work factor. This increases the risk of credential compromise, potentially leading to unauthorized access if credentials are reused or privileged. However, the vulnerability requires access to backups and does not enable remote exploitation by itself.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to system backups and ensure they are encrypted to prevent unauthorized retrieval of password hashes. Monitor for updates from Rockwell Automation regarding patches or configuration changes to increase bcrypt work factor.